Digital Team SixWater and wastewater cybersecurity in New Jersey
We protect the control systems that treat and deliver New Jersey’s water, for town utilities, county authorities and regional systems: SCADA and PLCs, pumps, chemical feeds and remote sites. Then we watch them around the clock to stop cyber incidents becoming boil-water notices or front-page news.
Control system, network and security vendors, and the sector groups we work with to protect industrial control systems.
Every system that treats, pumps or monitors water is now connected to something. Follow the tour, or pick a system.
Treatment, pumping, power, safety and the buildings around them all run on networked controls. Each connection is a way in, and each one needs a different kind of protection.
The brain of the plant: SCADA servers, HMIs and PLCs. We separate it from office IT and alert on any unexpected command sent to a controller.
The flow, level, turbidity and chlorine readings every decision depends on. We inventory each device passively, without touching fragile equipment.
One unauthorized dosing change is a public-health event. We restrict who can change setpoints and log every change that is made.
The intake, pumps, clearwells and towers that move water from source to tap. We flag abnormal pump commands and prepare your team to run safely in manual.
The automatic last line of defense against overflows and chlorine leaks. We keep safety controllers isolated and alert on any change to their logic.
Radio and cellular links to remote wells, tanks and lift stations. We find exposed sites and secure the path back to the plant.
Water-quality buoys and smart meters, often connected to a vendor's cloud. We bring them under the same inventory and access rules as the plant.
Substations, solar, drives and backup generators. When power controls fail, everything stops, so we monitor them and plan for failover.
Doors, cameras and alarms, often run by outside vendors. We wall them off from process control and put vendor access behind logged sessions.
Climate control for control rooms, electrical rooms and chemical storage. We put environmental changes in front of the same SOC that watches the plant.
The rules and programs we help clients meet, from EPA requirements for water systems to student privacy laws for schools.
Explore compliance
Federal inspectors and real incidents point to the same gaps: exposed controllers, default passwords and no one watching the plant network.
Nov 2024
EPA Inspector General
97 drinking water systems serving about 26.6 million people had critical or high-risk cybersecurity vulnerabilities visible from the internet.
Source: EPA OIG report, via WaterISAC
May 2024
EPA Enforcement Alert
More than 70% of community water systems inspected since September 2023 failed basic Safe Drinking Water Act security requirements. Default passwords and shared logins were common.
Source: EPA
Nov 2023
Aliquippa, PA
Attackers took over a booster station controller using its factory default password. Operators switched the station to manual.
Source: CISA
Section 1433 of the Safe Drinking Water Act requires every community water system serving more than 3,300 people to assess its cybersecurity risk, plan its response, certify both to EPA and repeat the cycle every five years. EPA is enforcing it. We deliver the whole package, built from your actual plant.
“Electronic, computer, or other automated systems (including the security of such systems)”
Next certification deadline: Emergency Response Plans for systems serving 3,301 to 49,999 people.
Section 1433(a)
We inventory and assess your SCADA, PLCs, remote sites and business IT, and write the cybersecurity section of your assessment.
Section 1433(b)
We write the cyber incident procedures your operators follow to detect an attack, isolate systems and run safely in manual, then rehearse them in a tabletop exercise.
Certification
You get a package mapped to EPA’s water sector cybersecurity checklist, with the evidence an inspector will ask to see.
Every 5 years
Culper-I keeps your asset inventory and risk picture live, so the next recertification starts from real data instead of a blank page.
Why now: EPA took at least 100 enforcement actions under Section 1433 between 2020 and 2024, and attacks hit water systems in at least seven states in July 2026. Congress is weighing bills that would tighten the requirements. In New Jersey, the Water Quality Accountability Act adds its own program, reporting and insurance rules, and we cover both in one program. Source: Congressional Research Service, Aug 2026
Platforms our clients already run, which our PIA and MSSP++ teams connect, secure and automate.
Industrial control systems are where we go deepest. The same team protects the agencies, schools and authorities around them.
Drinking water, wastewater, municipal utility authorities
Early warning and protection for the control systems behind treatment, pumping and distribution, delivered with the Culper-I EWS, with SDWA Section 1433 and NJ WQAA compliance built in.
State agencies, school districts, colleges
Find and fix your biggest digital risks, meet insurer requirements, and train every employee and staff member to spot an attack.
Transportation, roads and highways
Know where you are exposed, qualify for better cyber insurance, and turn your staff into the first line of defense.
Federal, New Jersey and New York
The rules you answer to, with the reporting channels, insurance and grants that go with them, and the products that get you there.
Attacks rarely start at the PLC. They start with a phishing email, a reused password or a vendor's remote connection, then move toward the plant. Six products and one team, so nothing falls into the gap between IT and OT.
Culper-I
Culper-I watches your SCADA, PLCs and remote sites around the clock, learns what normal looks like, and warns your operators the moment something changes, before an intrusion becomes an outage.
Monitoring is passive. It listens to network traffic and never sends commands to your controllers.
Result: water and wastewater compliance
Most utilities can’t fix everything at once, and they don’t need to. We sequence the work to your budget and your biggest risks, and every phase stands on its own.
Know what you have.
We map every connected device, find what is exposed to the internet, and give you a prioritized plan your board can fund.
Close the open doors.
We separate the plant network from office IT, put vendor remote access behind approved and logged sessions, and retire default and shared passwords.
Watch it around the clock.
Culper-I monitors your OT network 24/7. If something looks wrong, our SOC calls your operator and helps you run safely in manual while we respond.
Most utilities start with Review: an asset inventory, an exposure report and a gap analysis against SDWA and NJ WQAA.
Technology our SOC and MSSP++ teams deploy and integrate every day.
Digital Team Six was founded in 2018 to give public agencies the security expertise usually reserved for large enterprises. We are headquartered in Cranford with customer operations in Jersey City, close enough to be at your plant when it matters.
Today we protect 20 public-sector organizations, 2,500 endpoints and 7 control rooms.
We work alongside
Short answers to what water and wastewater leaders ask us first.
Digital Team Six is a New Jersey cybersecurity company, headquartered in Cranford with customer operations in Jersey City. We protect water and wastewater utilities across the state, from municipal systems to county and regional authorities, with OT risk assessments, Culper-I monitoring and a 24/7 security operations center. See our water and wastewater cybersecurity services.
Community water systems serving more than 3,300 people must assess their risks, including cybersecurity, keep an Emergency Response Plan, and certify both to EPA every five years. Emergency Response Plans for systems serving 3,301 to 49,999 people are next due December 31, 2026. Our Section 1433 guide covers every deadline.
Public community water systems with more than 500 service connections need a cybersecurity program built to NIST CSF, CIS Controls or ISO/IEC 27000, prompt incident reporting to the NJCCIC, cybersecurity insurance and an annual certification. Our WQAA checklist walks through each one.
No. Our assessments are non-intrusive, follow NIST SP 800-82 and run only with your approval, scheduled around your operators. Culper-I monitoring is passive: it listens to a copy of control traffic and never sends commands to your equipment.
Start with an OT risk assessment, so you know what you have and what is exposed. Then add hardening and monitoring as your budget allows. Every phase stands on its own.
Water and wastewater is where we go deepest, but the same New Jersey team protects the municipalities, counties, authorities and schools around them, from town hall IT to the security operations center.
Tell us about your utility. One of our OT engineers will walk you through how an assessment works and where we would start at your plant.
Prefer to talk now? 973-339-0090
© 2025 Digital Team Six, Inc. | Your Cyber. Our Passion.™ | Cybersecurity Solutions Specialized for Municipalities, K12, Education Sector and Non-profits.
